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(54) Electronic postage meter system separable printer and accounting arrangement 
incorporating partition of indicia and accounting information 



(57) A postage metering system (2) includes means 
(4) for printing a postage indicia. The printing means 
has first meter data stored therein. Means (8. 10) are 
coupled to the printing means for accounting for value 
printed by said printing means (4). The accounting 
means has second meter data stored therein. Means 



RG.1 



(26) are provided for operating the printing means (4) to 
print an indicia containing said first meter data from said 
printing means (4) and said second meter data from 
said accounting means (8, 10). 
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Description 

The present invention relates to postage metering 
systems. 

Traditional electronic postage metering systems 
include both a single printing arrangement associated 
with a single accounting arrangement. These printing 
and accounting systems have been traditionally housed 
in a single secure housing to provide for protection 
against tampering to provide for security. Other types of 
electronic postage metering systems have involved ihe 
utilization of portable detachably connectable account- 
ing systems such as smart cards and other portable 
type devices. 

These postage meter systems involve both prepay- 
ment of postal charges by the mailer (prior to postage 
value imprinting) and post payment of postal charges by 
the mailer (subsequent to postage value imprinting). 
Prepayment meters employ descending registers for 
securely storing value within the meter prior to printing 
whole post payment (current account) meters employ 
ascending registers account for value imprinted. Postal 
charges or other terms referring to postal or postage 
meter or meter system as used herein should be under- 
stood to mean charges for either postal charges, tax 
charges, private carrier charges, tax service or private 
carrier service, as the case may be, and other value 
metering systems, such as certificate metering systems 
such as is disclosed in co-pending European Patent 
Application No. 96 1 13 397.2 claiming priority from U.S. 
Patent Application Serial No. 08/518.404, filed August 
21. 1995. for SECURE USER CERTIFICATION FOR 
ELECTRONIC COMMERCE EMPLOYING VALUE 
METERING SYSTEM assigned to Pitney Bowes, Inc. 

Some of the varied types of postage metering sys- 
tems are shown, for example, in U.S. Patent No. 
3,978,457 for MICRO COMPUTERIZED ELECTRONIC 
POSTAGE METER SYSTEM, issued August 31, 1976; 
U.S. Patent No. 4,301.507 for ELECTRONIC POSTAGE 
METER HAVING PLURAL COMPUTING SYSTEMS, 
issued November 17, 1981; and U.S. Patent No. 
4,579,054 for STAND ALONE ELECTRONIC MAILING 
MACHINE, issued April 1, 1986. Moreover, other types 
of metering systems have been developed which 
involve different printing systems such as those employ- 
ing thermal printers, ink jet printers, mechanical printers 
and other types of printing technologies. Examples of 
some of these other types of electronic postage meters 
are described in U.S. Patent No. 4,168,533 for MICRO- 
COMPUTER MINIATURE POSTAGE METER, issued 
September 18, 1979; and U.S. Patent No. 4,493.252 for 
POSTAGE PRINTING APPARATUS HAVING A MOVA- 
BLE PRINT HEAD AN A PRINT DRUM, issued January 
15, 1985. These systems enable the postage meter to 
print variable information, which may be alphanumeric 
and graphic type information. 

Postage metering systems have also been devel- 
oped which employ encrypted information on a mail- 



piece. The postage value for a mailpiece may be 
encrypted together with the other data to generate a 
digital token. A digital token is encrypted information 
that authenticates the information imprinted on a mail- 

5 piece such as postage value. Examples of postage 
metering systems which generate and employ digital 
tokens are described in U.S. Patent No. 4,757,537 for 
SYSTEM FOR DETECTING UNACCOUNTED FOR 
PRINTING IN A VALUE PRINTING SYSTEM, issued 

10 July 12, 1988; U.S. Patent No. 4,831,555 for SECURE 
POSTAGE APPLYING SYSTEM, issued May 15. 1989; 
U.S. Patent No. 4,775,246 for SYSTEM FOR DETECT- 
ING UNACCOUNTED FOR PRINTING IN A VALUE 
PRINTING SYSTEM, issued October 4, 1988; U.S. Pat- 

, 5 ent No. 4.725,718 for POSTAGE AND MAILING INFOR- 
MATION APPLYING SYSTEMS, issued February 16. 
1988. These systems, which may utilize a device 
termed a Postage Evidencing Device (PED) or Postal 
Security Device (PSD), employ an encryption algorithm 

20 which is utilized to encrypt selected information to gen- 
erate the digital token. The encryption of the information 
provides security to prevent altering of the printed infor- 
mation in a manner such that any change in a postal 
revenue block is detectable by appropriate verification 

25 procedures. 

Encryption systems have also been proposed 
where accounting for postage payment occurs at a time 
subsequent to the printing of the postage. Systems of 
this type are disclosed in U.S. Patent No. 4,796,193 for 

30 POSTAGE PAYMENT SYSTEM FOR ACCOUNTING 
FOR POSTAGE PAYMENT OCCURS AT A TIME SUB- 
SEQUENT TO THE PRINTING OF THE POSTAGE 
AND EMPLOYING A VISUAL MARKING IMPRINTED 
ON THE MAILPIECE TO SHOW THAT ACCOUNTING 

35 HAS OCCURRED, issued January 3, 1989; U.S. Patent 
No. 5.293.319 for POSTAGE METERING SYSTEM, 
issued March 8, 1994; and, U.S. Patent No. 5.375,172. 
for POSTAGE PAYMENT SYSTEM EMPLOYING 
ENCRYPTION TECHNIQUES AND ACCOUNTING 

40 FOR POSTAGE PAYMENT AT A TIME SUBSEQUENT 
TO THE PRINTING OF THE POSTAGE, issued 
December 20, 1994. 

Other postage payment systems have been devel- 
oped not employing encryption. Such a system is 

45 described in U.S. Patent No. 5.391.562 for SYSTEM 
AND METHOD FOR PURCHASE AND APPLICATION 
OF POSTAGE USING PERSONAL COMPUTER, 
issued February 21 , 1995. This patent describes a sys- 
tem where end-user computers each include a modem 

so for communicating with a computer and a postal author- 
ity. The system is operated under control of a postage 
meter program which causes communications with the 
postal authority to purchase postage and updates the 
contents of the secure non-volatile memory. The post- 
55 age printing program assigns a unique serial number to 
every printed envelope and label, where the unique 
serial number includes a meter identifier unique to that 
end user. The postage printing program of the user 
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directly controls the printer so as to prevent end users 
from printing more that one copy of any envelope or 
label with the same serial number. The patent suggests 
that by capturing and storing the serial numbers on all 
mailpieces, and then periodically processing the infor- 5 
mation, the postal service can detect fraudulent duplica- 
tion of envelopes or labels. In this system, funds are 
accounted for by and at the mailer site. The mailer cre- 
ates and issues the unique serial number which is not 
submitted to the postal service prior to mail entering the ro 
postal service mail processing stream. Moreover, nc 
assistance is provided to enhance the deliverability of 
the mail beyond current existing systems. 

Recently, the United States Postal Service has pub- 
lished proposed draft specifications for future postage 15 
payment systems, including the Information Based Indi- 
cium Program (IBIP) Indicium Specification dated June 
13, 1996 and the Information Based Indicia Program 
Postal Security Device Specification dated June 13. 
1 996. These are Specifications disclosing various post- 20 
age payment techniques including various types secure 
accounting systems that may be employed, as for 
example, a single chip module, multi chip module, and 
multi chip stand alone module (See for example, Table 
4.6-1 PSD Physical Security Requirements, Page 4-4 of 25 
the Information Based Indicia Program Postal Security 
Device Specification). 

It has been discovered that the utilization of multiple 
accounting systems with a single printing mechanism 
pose unique and particular problems, particular I y where 30 
the system involves the generation and printing of digital 
indicia which include encrypted information such as dig- 
ital tokens to authenticate the validity of the indicia. 

It has also been discovered that problems in gener- 
ating the digital indicia where portable accounting sys- 35 
terns are employed may have additional problems of 
limited memory and/or processing speed capability 
such as smart cards. This is because generating digital 
indicia requires a certain level of computing capability 
and memory storage. <o 

It has been discovered that in metering systems 
that include a single printing arrangement with multiple 
accounting systems, information may be partitioned 
between the accounting arrangement and the printing 
arrangement to provide enhanced capability. 45 

It has been recognized that the information con- 
tained in an indicia can be separately generated in sep- 
arate modules thereby reducing the burden on any 
single module and providing enhanced security and 
portability for the system. so 

It is an object of the present invention to insure that 
a correct indicia is produced, with correct accounting 
while minimizing nonvolatile storage, programming size 
and processing necessary capability for metering sys- 
tems with portable accounting systems. 55 

Additionally, it is another objective of the present 
invention to enhance the speed at which a metering 
system can generate encrypted indicias to be imprinted 



on a mail piece. 

It is still a further objective of the present invention 
to provide a metering system, particularly those which 
employ portable accounting systems or accounting sys- 
tems with limited memory and/or processing speeds, 
which may generated encrypted indicia at speeds which 
allow real time imprinting of mailpieces with encrypted 
indicias. 

It is still a further objective of the present invention 
to enhance the security of postage meter systems with 
separable printing and accounting systems. 

It is yet a further objective of the present invention 
to enhance the information and data recovery of meter- 
ing related and other data in metering systems with sep- 
arable printing and accounting systems. 

It is an object of the present invention to provide a 
system wherein the printing and accounting are in sep- 
arate modules and the information to generate an indi- 
cia from both modules. 

As a further object of the invention to partition the 
information used in indicia that it can be efficiently and 
effectively generated in a distributed processing envi- 
ronment 

According to one aspect of the invention, a postage 
metering system includes means for printing a postage 
indicia. The printing means has first meter data stored 
therein. Means are coupled to the printing means for 
accounting for value printed by said printing means. The 
accounting means has second meter data stored 
therein. Means are provided for operating the printing 
means to print an indicia containing said first meter data 
from said printing means and said second meter data 
from said accounting means. 

Reference is now made to the accompanying draw- 
ings wherein like reference numerals designate similar 
elements in the various views and in which: 

FIGURE 1 is a schematic diagram of a postage 
meter system incorporating the present invention; 
FIGURE 2 is a flow chart of the metering system 
shown in FIGURE 1 in a multi -accounting system 
environment; 

FIGURE 3 is a flow chart of the operation of the 
postage meter system shown in FIGURE 1 deter- 
mining the type of an external portable means 
(shown as a smart card) connected to the system; 
FIGURE 4 is a flow chart of the operation of the 
meter system shown in FIGURE 1 in determining 
whether the portable means (shown as a smart 
card) contains the proper location data or other 
data employed in generating digital tokens; 
FIGURE 5A is a depiction of a digital indicia which 
may be printed by the electronic metering system 
shown in FIGURE 1; 

FIGURES 5B and 5C are digital indicias also suita- 
ble for being imprinted with metering systems of the 
type shown in FIGURE 1 and are set forth in the 
June 13. 1996 United States Postal Service Infor- 
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mation Based Indicium Program (1BIP) indicia 
Specification Draft in Appendix A-1 ; 
FIGURE 6 is a block diagram of the postage meter- 
ing system shown in FIGURE 1 with further infor- 
mation concerning the nonvolatile memory storage 
and the accounting subsystem module and the 
printing subsystem module; 
FIGURE 7 is a diagrammatic representation of the 
logical partitioning of information distributed 
between the print subsystem 4 and the accounting 
subsystems; and. 

FIGURE 8 is a flow chart showing the operation of 
the printhead subsystem memory and data of veri- 
fication. 

The electronic postage meter system shown in FIG- 
URE 1 includes an internal accounting system and mul- 
tiple removable external accounting systems. The 
external accounting system may be any suitable type of 
portable devices detachably coupled to the metering 
system. These include, for example, smart cards, 
ASICs, dongles and other types of removably coupled 
devices which provide for accounting functionality for a 
metering system. These may also include remote 
devices and systems which are detachably connectable 
to the metering system. 

The metering system involves multi secure 
accounting systems such as smart cards to provide 
accounting capability and functionality enhancement for 
the metering system. The term vault is used here inter- 
changeably with the term accounting system. The 
metering system is enabled to either utilize an internal 
secure accounting system only, an external secure 
accounting system only, or multiple secure accounting 
systems. The multiple secure accounting system meter 
has a secure internal secure accounting system, but 
can also accommodate an external secure accounting 
system. This allows a family of metering products to be 
developed and implemented that provides increased 
functionality and capability. 

Since portable devices are subject to loss and other 
security attacks such as theft or environmental prob- 
lems such as bending, rubbing, exposure to dust, liq- 
uids, sharp objects, etc., the maximum amount of funds 
that are stored within such a portable device may be 
limited. The limit may be a maximum consistent with the 
value metering system, for example, one hundred 
($100.00) dollars or any other selected amount. The 
internal secure accounting system may be a repository 
for larger amount of funds. Additionally, the portable 
device may be used in any of a large number of different 
metering systems, including Kiosk metering systems, 
thereby providing an increased functionality and utility 
to the meter system users. 

The metering system shown in FIGURE 1 includes 
an internal secure accounting system that may be phys- 
ically mounted in the metering system at the time of 
manufacture. This internal secure accounting system 



may be a smart card permanently mounted in the 
metering system or the smart card chip without the 
larger housing of the card itself. Such an accounting 
system itself may be housed within its own secure hous- 

5 ing such as is the case with a smart card chip or by 
means of a separate secure housing system. The smart 
card chip may consist of the smart card trimmed down 
to essentially a smaller version of the smart card. This 
may be manufactured by using a smart card plastic sub- 

70 strate that can be punched out from its carrier after the 
smart card chip is attached and thereafter the punched- 
out smart card chip mounted in the meter system. The 
punched-out smart card chip is like a normal smart card 
with most of the plastic substrate removed. The larger 

15 plastic substrate normally provides no functionality 
except to conform to the size requirements of the nor- 
mal credit card and to position the chip on the plastic 
credit card. Since the smart card chip is devoted to 
being permanently mounted internally within the meter- 

20 ing system, the smaller size is a benefit. That is, the 
punched-out smart card chip is never removed from the 
meter to be used in other non metering applications out- 
side of the metering system except as explained herein. 
This smart card chip is an integrated circuit housed in a 

25 plastic holder which is then connected to the printed cir- 
cuit board. It should be recognized that the integrated 
circuit itself can be directly mounted to the circuit board 
if desired or packaged in other integrated circuit for- 
mats. 

30 The smart card chip may be permanently mounted 
within the appropriate printed circuit connector (plug 
removable) or designed to be mounted directly on a 
meter system printed circuit board. Additionally, the 
metering system accommodates an external secure 

35 portable accounting system (for example, smart card) 
as well as the internal securing accounting system (for 
example, smart card) thereby providing additional 
advantages. Thus, manufacturing of economics of scale 
are achieved because identical or similar smart card 

40 chips or other devices are used for the external and the 
internal accounting system. 

The external secure accounting system when it is a 
smart card sized vault may be placed in a card slot or 
suitable detachable connector of the metering system. 

45 For a smart card, the card comes in contact with a spe- 
cial smart card connector designed for this purpose. 
That is. the metering system show in FIGURE 1 has a 
sensing means such as a switch or other device to 
detect the presence of the smart card prior to applying 

so voltage and reset to the pins on the card and also to 
sense the removal of the card or portable external 
accounting system. 

The multi-accounting system approach provides 
various advantages including higher funds retention 

55 (storage) for the internal secure accounting system, 
higher reliability for the internal accounting system, 
portability of the external secure accounting system, 
and flexibility for multi functionality connection to the 
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metering system such as ad slogans, "town circle 
graphics", authorization codes, data transfer, and rate 
table loading or software updates via the external 
secure accounting system connector. 

Higher funds retention (storage) for the internal 
secure accounting system is enabled because postal 
funds and other value can be inserted into the internal 
accounting system because it is permanently installed 
and is less subject to being lost or stolen as is the case 
of a small external portable accounting system. Higher 
reliability for the interna! secure accounting system 
occurs because it is mounted in the metering unit and is 
not subject to harsh external environments (tempera- 
ture/humidity, ESD), adverse handling, multiple inser- 
tion that wear and/or contaminate the contacts of a 
small external portable device. Portability of the external 
secure accounting system enables external devices to 
be used in multifunctional fashion such as a mini 
accounting system (that is a different card or external 
accounting system for each account) and enables the 
use of other features and functionalities. Additionally, 
added and other functionality may be included in the 
external accounting system such that, for example 
where the external secure accounting system is a smart 
card, the system can be a cash card or a credit card 
which additionally has postage accounting capabilities. 
Finally, as noted above, it is possible to employ the 
external vault as a vehicle to load ad slogans, rate 
tables, and authorization codes and other information 
into or out of the metering system. These transfers may 
be loaded under encryption control and/or be stored 
within the metering system such as in a print module or 
internal accounting system of the metering system 
where date storage may reside. 

Because the metering system employs multi secure 
accounting systems, an internal accounting system and 
an external accounting system, the metering system 
includes a prioritization arrangement to determine 
which accounting system should be used for debiting 
and crediting activity. 

Any time two accounting systems are present, a 
user wanting to print an indicia or digital token could 
enter postage value and debit the active accounting 
system. The metering system provides the capability for 
a system where many external accounting systems may 
be employed by a single metering system. The metering 
system includes a portable device connector which ena- 
bles funds debiting, token retrieval, funds audit and 
crediting of multiple accounting systems. Depending 
upon the meter system configuration of the number and 
type of secure accounting systems, internal to the 
metering system or external to the metering system, a 
selection criteria is used to choose the active account- 
ing system. The possible configurations in the metering 
system shown in FIGURE 1 include an internal secure 
accounting system only, an external secure accounting 
system only and an internal and (optional) external 
secure accounting systems. In the case where there are 



both an internal and optional external accounting sys- 
tem, a choice must be made as to which accounting 
system should be used when both accounting systems 
are present in the metering system. 

s The metering system shown in FIGURE 1 accom- 
modates the generation of digital tokens by both the 
internal and external secure accounting systems. Since 
the indicia includes the digital token and/or other infor- 
mation (as for example the information set forth in the 

w proposed U.S. Postal Service Specifications), it is nec- 
essary to insure for a valid mailpiece to be prepared that 
the proper accounting system information is utilized in 
generating the digital token and that such digital token is 
employed in printing the mailpiece. This is necessary for 

15 the mailpiece to properly be put into the mail stream by 
the mailer and so that the carrier service may properly 
authenticate the mailpiece. 

Digital tokens to be printed by the metering system 
2 may include information which is in part based on the 

20 licensing Post Office zip code or other location informa- 
tion related to the meter user, hereinafter referred to as 
origin postal code. Currently, postage meter secure 
accounting systems which generate digital tokens are 
mounted within a meter base housing. This prevents the 

25 accounting system from being moved between meter 
bases. 

When an indicia is printed, digits are generated that 
utilize forms of the origin postal code that are then 
printed as part of the indicia. These digital tokens are 

30 then used to verify the correctness and validity of por- 
tions of the digital indicia. Since historically, there is only 
a single vault (accounting system) and a single printing 
engine and the system is not easily portable (as a smart 
card), meter location movement has not been as seri- 

35 ous an issue. With portable external accounting system 
meters, however, it is quite easy to move and use a port- 
able secure accounting system between many printing 
engines "bases" spanning different postal regions (ori- 
gin postal codes). The present system helps assure that 

40 the secure accounting system utilizes the correct postal 
code related data when generating the secure digital 
tokens or indicia. 

Moreover, in a metering system such as shown in 
FIGURE 1 that provides the capability of supporting 

45 more than a single secure accounting system, such as 
plural portable external accounting systems which may 
be from different origin postal codes, the meter system 
operates to update the packed postal code (origin 
postal code with any desired additional data) and the 

so postal check digit that may be used by the vault to gen- 
erate the secure digital tokens. The system shown in 
FIGURE 1 stores target origin postal codes and oper- 
ates to detect and transfer the origin postal codes to the 
secure accounting system to assure correct generation 

55 of the digital tokens. 

The digital indicia or digital token contains an area 
of secure information that is used to verify the correct- 
ness and authenticity of the digital indicia. For example, 
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these digital tokens may include the vendor ID, vendor 
digital token, postal digital token, and an indicia check 
digit. In encryption systems of this type, in order to cor- 
rectly generate the indicia check digit, vendor digital 
token, and postal digital token, the packed postal code 5 
and the postal check digit for the origin postal code may 
be used. The origin postal code is usually the code 
associated with where the mailpiece will be sent from. 
This has also usually indicated where the meter is 
located. However, in products which separate the vault 70 
from the printing engine or "base", the vault can easily 
be moved from one origin postal code location to 
another. The packed postal code is derived from the ori- 
gin postal code and it is used to represent the origin 
postal code in the calculation of the digital tokens men- 
tioned above. The postal check digit represents the con- 
tribution of the origin postal code to the indicia check 
digit 

Since the metering system printing module may be 
physically contained within the base portion, it is not as 
easy to transport (as a portable external accounting 
system, e.g. smart card) and less likely to be moved 
between postal code locations. If this unit is moved, it is 
expected the user would contact the meter system man- 
ufacturer so that the postal code location stored within 
these systems may be updated. On the other hand, the 
external secure accounting system is quite easily trans- 
portable within a postal code region or between postal 
code regions. Furthermore, since in the present system 
there is no need for a correlation to be made between 
the external accounting system and the base and print- 
ing engine, any external accounting system may use 
any base with its associate removable printing module. 

To insure correctness of the token generation, a 
master set of the origin postal code along with its asso- 
ciated packed postal code and postal check digit are 
stored within the base printing module. The initialization 
of this information occurs the first time the meter system 
user contacts the manufacturer for the initial refill of the 
secure accounting system with postage funds. At this 
first refill, the meter system recognizes it needs all of the 
postal code related data and electronically requests the 
data be downloaded to memory. At this time, the system 
will update the currently active secure accounting sys- 
tem in the meter system. The active secure accounting 
system could be either embedded within the meter sys- 
tem (internal accounting system) or inserted into the 
meter system connector. Anytime, an accounting sys- 
tem is inserted into the metering system, the meter sys- 
tem operates to determines whether the secure 
accounting system possesses the same postal check 
digit that is stored as the master postal check digit 
stored in the memory of the printing module (or where 
ever else in the base this information may be stored). If 
the postal check digits match no update is made. This is 
done to minimize the number of writes to nonvolatile 
memory of the secure accounting system. The nonvola- 
tile memory in the meter system may have a maximum 



number of write cycles before the memory starts to 
degrade. This number correlates to the maximum of 
number debits made against the meter and conse- 
quently the maximum number of times that tokens will 
be generated. 

For meter systems configured with an internal 
secure accounting system, the update of the internal 
accounting system postal check digit are initialized at 
the time the data is received for the base print module 
initialization. The packed postal code could be updated 
in the secure accounting at this time as well; however in 
the preferred implementation, the packed postal code is 
transmitted at the time the postage funds and date of 
submission are transferred to the secure accounting 
system. The vault then uses the information it received 
prior to the debit as well as information received during 
initialization at the time the vault was inserted into the 
base unit housing. 

Reference is now made to FIGURE 1. A postage 
meter system shown generally at 2, includes a remova- 
ble printhead module 4 within a housing 5, a base mod- 
ule 6 and a secure internal accounting system module 8 
and an external secure accounting system module 10 
which will be hereafter explained in greater detail. The 
accounting systems include an internal accounting sys- 
tems 8 and an external accounting system 10. These 
accounting systems account for the operation of the 
metering system and for the printing of postage value. 

The print module 4 includes a printhead 12 which 
may be an ink jet printhead or other variable printing 
means. A printhead driver 14 provides the necessary 
signals and voltages to the printhead. A temperature 
sensor 16 is used to sense the ambient temperature. 
Since ambient temperature changes the viscosity of the 
printhead ink, this information enables change of the 
signals and voltages to the printhead to maintain a con- 
stant drop size. 

A smart card chip 18 which contains internal non- 
volatile storage receives encrypted command and con- 
trol signals from the base unit and provides information 
to the ASIC 20 to operate the printhead driver 14. The 
ASIC, may be of the type described in U.S. Patent No. 
5,651.103 entitled MAIL HANDLING APPARATUS AND 
PROCESS FOR PRINTING AN IMAGE COLUMN-BY- 
COLUMN IN REAL TIME and assigned to Pitney 
Bowes, Inc., the disclosure of which is hereby incorpo- 
rated by reference. The ASIC is connected to a crystal 
clock 22, obtains the necessary operating program 
information from a ROM or flash memory 24 so as to 
appropriately control the sequence of the information to 
the ink printhead driver such that the printhead pro- 
duces a valid and properly imprinted indicia (which 
herein is meant to include a digital token in whatever for- 
mat it is to be imprinted). 

The base module includes a micro controller 26 
which is connected to operate the electronic postage 
meter system motors and display and is coupled to the 
various accounting systems. The micro controller 26 is 
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connected to a modem 28 which includes a modem chip 
30 connected to a crystal clock 32 and a data access 
arrangement 34 for enabling modem communications 
between the metering system 2 and external systems. 

An RS 232 port 27 is provided. The RS 232 port 27 
is connected to the micro controller 26 via a switch 29 
which is operated under the control of the micro control- 
ler 26 such that either the RS 232 port 27 is enabled or 
the modem 28 is enabled. Should the RS 232 port 27 be 
enabled, the port may be used for communicating with 
the metering system by way of modem, direct connec- 
tion or other serial communication technique suitable for 
RS 232 communications. 

The micro controller 26 additionally provides vari- 
ous control signals to operate the meter system includ- 
ing signals to the printhead carriage motor, the 
printhead shift motor and the printhead maintenance 
motor which are utilized to move, position and maintain 
the printhead 12. The micro controller 26 is operated 
under control of two separate crystal clocks 36 and 38. 
The higher frequency 9.8 megahertz crystal clock is 
used when the electronic meter system is in active oper- 
ation and the lower speed 32 kilohertz crystal clock 36 
is used when the meter is in a "sleep mode" and the dis- 
play is blanked and the system is in a quiescent state. 

Various power is provided to the micro computer 
and to the electronic postage meter system including a 
5 volt regulated power supply 40, a 30 volt adjustable 
power supply 42, and a 24 volt regulated power supply 
44. Additionally, a battery 46 is connected via a battery 
backup circuit 48 to the micro controller 26 to provide 
operating power for an internal clock in the micro con- 
troller 26 when the external source of AC operating 
power 50 is disconnected. 

Various electronic postage meter sensors are con- 
nected to the micro controller 26 including envelope 
sensor 52 which senses the presence of an envelope in 
the envelope slot of the metering system, shift home 
sensor 54, which senses the home position of the shift 
motor (Y motor), a cam home sensor 56 which senses 
the cam position which controls the envelope platen 
movement, a carriage home sensor 60 which senses 
when the printhead 12 is in a home position, and a 
cover open sensor 57. 

The micro controller 26 is additionally connected to 
a key pad 62 and an LCD Display Module 64. This ena- 
bles a user to enter data into the metering system and 
to view information shown in the display 64. 

The metering system 2 employs two accounting 
systems. The first accounting system involves the inter- 
nal smart card (or smart card chip) 8 and the second 
accounting system involves an external smart card 10. 
These smart cards are micro processor based devices 
which each provide for secure metering functionality. 
These smart card accounting systems or smart card 
vault systems securely maintain various registers asso- 
ciated with the metering system and provide the meter 
accounting functionality. Additionally, the accounting 



systems provide for the capability of communicating 
register information and postage refilling and removal 
information to add or remove value from the various 
accounting registers. Each of the secure accounting 

5 systems generate the indicia and/or digital tokens 
needed to be imprinted on a mailpiece by the printhead 
12. Additionally, the modules provide for encrypted 
communications into and out of the accounting system 
such as may be associated with the funds refilling or 

to funds debiting function. For the particular embodiment 
shown, the accounting system provides for authentica- 
tion of the printhead module smart card 18 and the 
accounting system. Whenever there is a request by a 
user through the keypad 62 or otherwise, to print post- 
75 age, or whenever else it is desired, a mutual authentica- 
tion occurs. The accounting system authenticates that it 
is in communication with a printhead module smart card 
chip 18, each authenticating the other as being authen- 
tic and valid metering system. Thereafter encrypted 

20 communications are enabled between the active secure 
accounting system and the smart card chip 18 which is 
part of the printing system to provide security that the 
messages are authorized uncorrupted messages. This 
may be by way of a cryptographic certificate. 

25 The metering system 2 provides added functionality 
and capability to the system by the employment of the 
two separate accounting systems 8 and 1 0. The internal 
smart card accounting system 8 is connected to the 
micro controller 26 via a plug connector 66. This facili- 

30 tates removal of the internal smart card 8 should exter- 
nal inspection be required where the device is 
inoperative. A 3.57 megahertz crystal clock 68 is con- 
nected to the smart card 8 and to the micro controller 
26. Additionally, the clock 68 is connected to the exter- 

35 nal smart card 10 via the external smart card plug con- 
nector 70. The micro controller provides a smart card 
sensor switch 72 detects the presence or absence of 
the external smart card 10. When the external smart 
card is detected as being present, the switch is con- 

40 nected to the micro controller 26 via the smart card 
power control circuitry 74 causing the micro controller 
26 to enable the external smart card power control cir- 
cuitry 74 to apply power to the external smart card and 
gating the crystal clock 68 to provide clock signals to the 

45 external smart card 1 0, both via the smart card connec- 
tor 70. 

It should be expressly noted that the system is con- 
figured such that it may be a system operated with both 
the internal accounting system 8 and an external 

so accounting 1 0, with only the internal accounting system 
8 and only with the external accounting system 10. 
Moreover, the external smart card 1 0 is arranged so that 
it can be connected to other electronic metering sys- 
tems and provides a portable means for a user to have 

55 postal funds available for imprinting on a mail piece or 
tape on other than a specific postage metering system. 
However, even when connected to a different electronic 
postage metering system the same authentication 
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between the external smart card 10 and the print head 
smart card chip 18 occurs. 

The system is designed with a priority arrange- 
ment. If no external secure accounting system, such as 
a smart card 10, is connected to the electronic postage 
meter system 2 the meter accounting functionality is 
provided by the internal secure accounting system 
smart card 8. This internal accounting system becomes 
the active accounting system for the metering system. 
However, if an external accounting system is connected 
into the system via the connector 70 ; the system will 
make the external accounting system, smart card 10, 
the active accounting system for the metering system 2. 

Connector 70 is a flexible multi purpose connector. 
The connector 70 enables connections of other types of 
smart cards such as card 76 which contains ad slogan 
information (alpha numerics and/or graphic information) 
card 78 which contains rate table information, and smart 
card 80 which contains authentication code information. 
It should be recognized that when each of these cards 
76, 77 or 80 is connected into the system via the multi- 
function connector 70 a self authentication process is 
effectuated between the smart card and the print mod- 
ule smart card chip 18 to ensure that valid cards and 
data are being employed. It may use the same encryp- 
tion and/or cryptographic certificate techniques to 
ensure valid authentic and uncorrupted message com- 
munication. This system may be used for moving infor- 
mation and data into and out of the meter system 2. 

The information of the type stored on cards 76, 78 
and 80 are communicated from the card via the connec- 
tor and the micro controller 26 to the smart card chip 18, 
the ASIC 20 and is stored in the flash memory 24 or the 
smart card chip 1 8 internal memory. For those embodi- 
ments which employ a ROM rather than a flash memory, 
the information is written into the print module smart 
card chip 18. 

A refilling operation for the metering system 2 may 
be remotely implemented via the modem 28 or RS232 
connector 27. A remote connection is established via 
the modem 28 or RS 232 connector 27 to a remote data 
center. This enables bi-directional communication 
between the data center via the modem 28 or connector 
27 via the micro controller 26 to either the internal 
accounting system 8 and/or the external accounting 
system 10 and to the print module smart card chip 18. 
The system is configured such that if an external smart 
card 10 is connected to the system via connector 70, 
the communications will be with the external smart card 
and not the internal smart card chip 8. It should be 
expressly recognized that other protocols can be imple- 
mented by use of the keyboard to designate which of 
the two accounting systems should be the active sys- 
tem for the purpose of recharging or other meter system 
operation. 

Whether communication is with the internal smart 
card chip 8 or the external smart card 10, the communi- 
cations involves the remote data center interrogating 



the internal or external accounting system to obtain 
necessary information such as the status of the funding 
registers (ascending register and descending register) 
other inspection information such as evidence of tam- 

5 pering, meter system serial number, internal resettable 
timer status and resets, and other information depend- 
ing upon the nature of the particular system. For 
recharging, the user may enter via the keyboard 62 a 
desired postage funding refill amount and upon suitable 

w and successful interrogation of the active accounting 
system, the remote data center provides an encrypted 
recharging message which is communicated into the 
accounting system enabling refunding of the accounting 
system register with added additional postage value. It 

75 should be also noted that communications in this matter 
enables remote inspection of the metering system 
integrity and to upload or download other information 
relating to the meter system operation such as monitor- 
ing the operability and maintenance from the print mod- 

20 ule 4. Additionally, if various meter usage information is 
maintained in the system, this information may be 
uploaded to the remote data center. Moreover, the 
remote data center provides a vehicle for downloading 
additional and new encryption key or keys into the sys- 

25 tern if so configured and provides the capability for other 
functionality and services such as meter usage profile. 
Moreover, at the time of remote meter resetting, a 
receipt may be caused to be imprinted by the print mod- 
ule as a receipt for the postage accounting system 

30 funds refilling. The receipt provides tangible evidence to 
the user of the date, time, amount and other pertinent 
data of the postage accounting system refilling transac- 
tion. The receipt may include transaction number and 
encrypted data such as a cryptographic certificate, 

35 In generating digital tokens or indicia, in certain 
instances and for certain postal authorities, the digital 
token is required to contain information concerning the 
physical location of the electronic postage of the meter- 
ing system. This may be because of licensing require- 

40 ments wherein a particularly meter is licensed to be 
operated in a particular location, as for example within a 
particular zip code area, the originating postal code of 
the mailer. The metering system 2 accomnriodates this 
requirement and enables the utilization of an external 

45 smart card from originating zip locations other than that 
the of the license location for the metering system 2. 
The meter location information may also be important 
where it is required for use when metered mail must be 
deposited within the zip code or originating location of 

so the mailer. 

In initialization of the meter, that is when the meter 
is put into service and rendered operable, the location of 
the metering system 2 is stored in the print module 
memory 24 or the internal memory of chip 18. This infbr- 

55 mation may be the originating zip code for the mailer or 
other required location or other information. The infor- 
mation in the flash memory 24 or the smart card chip 18 
is employed in imprinting a indicia or digital token on a 



8 



15 



EP0 825 565 A2 



16 



mail piece by print head 12. It is necessary that the dig- 
ital token generated either by the external smart card 10 
or the internal accounting module 8 be such that the 
digital token which contains originating postal code data 
is accurate and consistent with the data stored in the 
flash memory 24 or smart card chip 18 internal memory. 

At the time of initialization, the originating location 
data may be also stored in the internal accounting sys- 
tem 8. When an external accounting system or smart 
card 10 is connected into the system, and a request for 
postage is initiated, as part of the authentication proc- 
ess, communication is established between the external 
accounting system 10 and the print head smart card 
chip 1 8. At that time, a comparison is made between the 
originating location information stored in the flash mem- 
ory 24 or smart card chip 18 internal memory and the 
originating location information stored in the external 
smart card 10. If there is a correspondence between 
these two stored location information, the printing of 
postage and generation of the digital token or indicia 
may proceed in the norma! fashion with any other 
authentication and processing that may be employed. 
However, if the location information stored in the flash 
memory 24 or smart card chip 18 internal memory is 
inconsistent with the location information stored in the 
external smart card 10, the system will not operate. At 
this time, the location information in the external smart 
card is written over or alternatively may be put in a sep- 
arate memory location (a travel memory location). Cor- 
respondence now exist between the location 
information stored in the flash memory 24 or smart card 
chip 18 internal memory and the location information 
stored in the external smart card 10. Thus, when 
imprinting postage and generating digital tokens an 
agreement exists between the data generated on the 
mail piece from the location information in the flash 
memory 24 or smart card chip 18 internal memory and 
from the location information stored in the external 
smart card 10. 

If desired and as part of a routine check, the loca- 
tion information stored in the external smart card can be 
periodically checked against the location information 
stored in the flash memory 24 or smart card chip 18. 
Moreover, location information stored in both the flash 
memory 24 and the internal accounting system or exter- 
nal accounting system can be checked, if desired, 
whenever communications are established with the 
remote accounting center via the modem 28 or RS232 
connector 27. Still further, should it be desired, a special 
purpose externa! smart card may be connected into the 
system to interrogate and verify various information 
stored both in the flash memory 24 and the internal 
smart card chip 18 or internal accounting system 8. 

Reference is now made to FIGURE 2. At 82 the 
electronic postage meter system 2 is powered up. A 
determination is made at 84 if the system is a multi 
secure accounting (vault) system. That is, a determina- 
tion as to whether the system includes multi accounting 



systems. If the system is not a mutti vault accounting 
system, a further determination is made at 86 if the sys- 
tem is an internal vault system. If the system is not an 
internal vault system, the system must be an external 

5 vault only system. Accordingly, at 88. the system waits 
for a vault to be inserted. 

When the external vault is inserted at 90 (or deter- 
mined to be already present), the system uses the 
external vautt for all accounting and for other secure 

10 functions at 92. Should the external vautt be removed as 
is shown at 94, a determination is then made if an inter- 
nal vault system is at 86. If no internal vault is present, 
no valid accounting system remains in the meter system 
2 and a fatal error is displayed at 98 in the display 64. 

is The meter system is rendered inoperable for printing 
postage and other operations requiring a secure 
accounting system. 

If a determination is made that the system is a multi 
vault system at 84, a further determination is made at 

20 1 00 if two vaults are present in the system, tf two vaults 
are present, the system will use the external vault as 
shown at 92. Thus, where two vaults are present, the 
system always defaults to using the external vault. If a 
determination is made that two vaults are not present in 

25 the system at 100, the operation continues to decision 
box 96 as previously noted. If a determination is made 
that an internal vault is present at 96, the system uses 
the internal vault as shown at 102. This would also be 
the case from decision box 86 where a determination is 

30 made "if the system is an internal vault system. 

As can be seen from the above, when the system is 
powered up, the meter system 2 always defaults to 
operation using the external accounting system or vault. 
If, however, the external vault is removed at any time 

35 during operation, the system changes to utilization of 
the internal vault when the external vault is removed. If. 
on the other hand, the system has only an external 
accounting system or vault and the vault is not present, 
the system waits until an external vault is inserted into 

40 the system to commence operation. Further, if the sys- 
tem is an internal vault only system and a vault is not 
sensed as being present, the system will display a fatal 
error and will not operate. 

Reference is now made to FIGURE 3. A card is 

45 inserted into the system at 104. A determination is 
made at 106 if the card is an accounting vault (external 
vault). If the card is determined to be an accounting 
vault smart card, the smart card is used for accounting 
as shown at 108. If the card is determined not to be an 

so accounting card, a determination is made at 1 10 if the 
card is an ad slogan card. That is, a card containing 
inscription information, graphic information or both for 
imprinting by the metering system 2. If a determination 
is made that the system is an ad slogan card, the sys- 

55 tern is placed in the ad slogan mode at 1 12. A determi- 
nation is then made at 114 if the ad slogan card is 
authentic. That is, a determination is made by means of 
a encrypted message such as by use of cryptographic 
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certificate between the ad slogan card and the print 
module smart card chip 1 8 whether the card is valid and 
the ad slogan information on the card is also valid and 
are authenticated. If the card and/or data is determined 
to be valid, the ad slogan down load is completed at 
116. If the card and/or data is not authenticated, an 
error message is displayed in the display 64 at 1 18 and 
a request is made that the user remove the ad slogan 
card at 120. Returning to step 1 10, if the answer to the 
inquiry is "NO", an error message is displayed at step 111 
requesting that the card be removed. 

It should be recognized that if other types of cards 
are employed, such as those shown in FIGURE 1 which 
contain authentication code information, rate table infor- 
mation, etc. the flow chart, shown in FIGURE 3, would 
have further operational steps to determine the nature 
of such card and authenticate the card and the informa- 
tion on such card and proceed or not proceed to down- 
load the necessary information as appropriate. This 
would be in a manner similar to that as is the case with 
the ad slogan card. Moreover, the system further ena- 
bles information to be transferred from the meter to the 
card and written into the card for the purpose of inspec- 
tion, information transmission and any other desired 
functionality such as transferring funds from an internal 
vault to an external vault for withdrawal of funds from the 
metering system. 

Reference is now made to FIGURE 4. A vault is 
inserted into the meter system at 122. This may be an 
internal accounting system inserted at the time of man- 
ufacture or an external vault inserted at any time during 
use. Additionally, should a different vault be inserted 
into the system as a substitute for the internal vault this 
procedure will also be followed. Additionally, the proc- 
ess is followed during power up of the metering system. 

The postal code and postal check digit or other 
information is read from the vault at 124. At 126 it is 
determined if this postal code and postal check digit or 
other information matches with the postal code and 
postal check digit and other information stored in the 
meter system. Information is stored in the meter system 
printing module in flash memory 24 or printing module 
smart card chip 18 internal memory. If the information 
matches, the system continues initialization and opera- 
tion at 128. If the information does not match, the vault 
(accounting system) and printer printing module 
attempt to authenticate each other at 130. If it is deter- 
mined at 132 that the accounting system module and 
the printing module are each valid and have authenti- 
cated each other, the postal code and postal check digit 
or other data stored in the printer module flash memory 
24 or smart card chip 18 internal memory are written 
into the vault at 136. The meter system continues its ini- 
tialization and operation at 141 . 

If it is determined at 1 32 that the accounting system 
and printing module are not valid, that is, they have not 
authenticated each other, a fatal error message is dis- 
played in the display 64 and the system does not oper- 



ate at 134. 

Reference is now made to FIGURE 5A. FIGURE 5A 
shows a digital indicia suitable to be imprinted by the 
postage meter system shown in FIGURE 1. This indicia 

5 contains alpha numeric information, which also may be 
printed in bar code format including PDF 417 bar code 
or other forms of bar code. The digital indicia includes a 
postal code 142 which is the licensing post office for the 
meter user, the date of submission of the mailpiece 1 44, 

10 the indicia or meter or postal security device serial 
number 146. This identifies the device which has 
printed the indicia. The postage amount imprinted on 
the mailpiece or tape is shown at 148. A vendor identifi- 
cation is imprinted at 150 as are a vendor digital token 

is 152 and a carrier or postal service digital token 154. 
These digital tokens provide means for authenticating a 
mailpiece by information printed in the indicia to ensure 
that the indicia is valid and has been printed by an 
authorized postage metering system and has not been 

20 altered. The indicia may also include a piece count 1 56, 
which shows the number of pieces the metering system 
has printed; an indicia check digit 153, which is a single 
decimal digit generated from variable information in the 
indicia, that is intended to help detect errors in these 

25 quantities and a meter check digit 140, which is a pair of 
decimal digits identifiers generated from decimal values 
identifying the meter and the meter manufacturer, that is 
intended to help detect errors in these quantities. 
It should be noted that the information content 

30 organization and arrangement of the digital indicia are a 
matter of choice as is the form in which the digital indicia 
is imprinted. The digital indicia may be imprinted entirely 
in alpha numerics, entirely in any form of bar code or 
other coding arrangement or in a combination of alpha 

35 numerics and bar coding or other form of coding. 

Reference is now made to FIGURES 5B and 5C. 
These FIGURES depict various forms of digital indicia 
imprinted entirely in bar code, PDF 417, format. FIG- 
URE 5B shows an indicium 160 signed using DSS while 

40 FIGURE 5C is an indicium 162 signed using RSA. Both 
examples of such mailpiece indicium from the U.S. 
Postal Service Draft Information Based Indicia Program 
(IBIP) Indicia Specification dated June 13, 1996, 
Appendix A-1. 

45 Reference is now made to FIGURE 6. The printing 
of subsystem module smart card chip 18 includes a 
nonvolatile memory storage 602 which provides a 
secure working memory for the smart card chip 18. The 
memory in 602 is an electronically alterable nonvolatile 

so memory, commonly referred to as an EEPROM. The 
smart card chip 18, as previously noted is connected to 
the ROM or nonvolatile memory 24. Fa the embodi- 
ment shown in FIGURE 6 the configuration is a nonvol- 
atile memory. 

55 The print module 4 is connected via the base mod- 
ule 6 to the various accounting subsystems shown gen- 
erally at 604. As is shown and noted above, the 
accounting subsystem may consist of multiple different 



19 



EP 0 825 565 A2 



20 



accounting subsystems, with each accounting subsys- 
tem having its own processor with nonvolatile memory. 
As previously noted, these may, for example, be smart 
cards or other types of devices. 

Reference is now made to FIGURE 7. The informa- s 
tion in the metering system 2 is partitioned. The infor- 
mation is distributed between the print module 4 and the 
various accounting subsystems that may be utilized with 
the meter system 2. The information has been parti- 
tioned in a distributed logical fashion. It is partitioned to to 
particularly accommodate the portability of the various 
accounting subsystems that can be used with the 
metering system 2. It is also partitioned in a way to gain 
benefit from the recognition that the metering system 2 
is less portable than the accounting subsystems. The 15 
print module component data is shown in 702 and the 
accounting subsystem component data is shown at 
704. 

The print module component data may include: 
systems usage record; master country configuration 20 
data; master systems configuration data; master postal 
recorded data (such as origin postal code); master 
accounting record (such as descending register, etc. 
any internal accounting system, rf any); printing fonts; 
master display languages (more than one is possible); 25 
master printer control data; master security tables which 
contain data relating to the security aspects of the sys- 
tem; and, master indicia components (such as eagle 
wings, other graphics, standard phrases such as mailed 
from, and other fixed components of the indicia). 30 

The accounting subsystem component data may 
include the following types of data: accounting registers; 
security tables; usage logs (such debit transactions or 
refill transactions); inspection records; customer param- 
eter (such as authorization codes; pin numbers; expira- 35 
tion dates); warning limits (such as high value warning, 
low value warning); and, variable indicia data compo- 
nents (such as meter serial number; check digits, and 
postal check digits). 

It should be recognized that this data configuration 40 
can be modified to meet the requirements of different 
national postal systems where different information is 
required to be stored by the metering system and where 
different information may be required to be printed as 
part of the indicia. Moreover, the nature and organiza- 45 
tion of the information may also change for different 
types of indicias, encrypted indicias and digital tokens. 

Reference is now made to FIGURE 8. The data in 
the printhead subsystem is maintained as a working 
copy in the smart card chip 18 internal memory and as so 
a master copy in the nonvolatile memory 24. The sys- 
tem is initially powered up at 702. At 704, the print mod- 
ule verifies the integrity of the master data records in the 
memory 24. If the data is verified, the print module cre- 
ates a working copy of the master record in the smart ss 
card chip memory 18 at 706. The print module continu- 
ously verifies the integrity of the master records and 
working copies at 708 during the operation of the meter- 



ing system. This is a continuous process that continues 
as long as the power is applied to the system. Assuming 
the data is verified, the printhead controller (which is the 
smart card chip 18) processes messages to the print- 
head controller as required and then returns operation 
of the system to the verification of the integrity of the 
master record and working copies at 708. 

If the integrity is not verified at 708, a determination 
is made at 710 if the language records are affected by 
the non-verification. If they are not affected by the prob- 
lem, an error message is displayed in the display 64 
(FIGURE 1) at 712, tf the language records are not 
valid, the display 64 merely displays a numeric indicator 
that there is a system failure and the metering system is 
rendered inoperable. 

tt should be noted that in the beginning of the proc- 
ess, should the print module fail to verify the integrity of 
the master records, the program branches to decision 
block 710. 

While the present invention has been disclosed and 
described with reference to the specific embodiments 
set forth herein, it will be apparent, as noted above and 
from the above itself, that variations and modifications 
may be made therein. It is. thus, intended in the follow- 
ing claims to cover each variation and modification that 
falls within the true spirit and scope of the present inven- 
tion. 

Claims 

1 . A postage metering system comprising: 

means (4) for printing a postage indicia, said 
printing means having first meter data stored 
therein; 

means (8, 10) coupled to said printing means 
(4) for accounting for value printed by said 
printing means, said accounting means having 
second meter data stored therein; and 
means (26) for operating said printing means 
(4) to print an indicia containing said first meter 
data from said printing means and said second 
meter data from said accounting means (8, 1 0). 

2. A metering system as defined in Claim 1 wherein 
said accounting means (10) is detachably coupled 
to said printing means (4). 

3. A metering system as defined in Claim 1 or 2 
wherein said first meter data is origin postal code 
data and said second meter data is encrypted data 
containing information related to said origin postal 
code data. 

4. A postage metering system comprising: 

means (4) for printing a postage indicia con- 
taining encrypted information for enabling vali- 
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dation of said indicia, said printing means 
having first meter data stored therein; 
means (8, 10) coupled to said printing means 
for accounting for value printed by said printing 
means (4), said accounting means having sec- s 
ond meter data stored therein; and 
means (26) for operating said printing means 
(4) to print said postage indicia containing said 
first meter data from said printing means (4) 
and said second meter data from said account- w 
ing means (8, 10). 

5. A metering system as defined in Claim 4 wherein 
said second meter data contains encrypted infor- 
mation. 15 

6. A metering system as defined in Claim 5 wherein 
said first meter data is origin postal code data and 
said second meter data encrypted information is 
related to said origin postal code data. 20 

7. A metering system as defined in Claim 6 wherein 
said accounting means contains accounting means 
identifying data and said second meter data 
encrypted information is further related to said 25 
accounting means identifying data. 

8. A metering system as defined in Claim 7 wherein 
said second meter data encrypted information is 
further related to the value of said postage indicia. 30 

9. A metering system as defined in Claim 8 including 
accounting means (10) removably coupled to said 
printing means (4). 

35 

10. A postage metering system comprising: 

means (4) for printing a postage indicia con- 
taining encrypted information for enabling vali- 
dation of said indicia, said printing means 40 
having postal origin code data securely stored 
therein; 

means (8, 10) coupled to said printing means 
(4) for accounting for value printed by said 
printing means, said accounting means having 45 
second meter data securely stored therein, 
said second meter data including data related 
to accounting means identifying data and 
postal origin code data ; and 
means (26) for operating said printing means so 
(4) to print said postage indicia containing said 
first meter data from said printing means (4) 
and said second meter data from said account- 
ing means (8, 10) containing encrypted infor- 
mation relating to said origin postal code data ss 
and said accounting means identifying data. 
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